Merge pull request 'Dev' (#2) from dev into master

Reviewed-on: #2

flake.lock

@@ -1,5 +1,26 @@
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager",
+        "nixpkgs": "nixpkgs",
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1770165109,
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
     "aquamarine": {
       "inputs": {
         "hyprutils": [
@@ -20,11 +41,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745357003,
+        "lastModified": 1784368054,
-        "narHash": "sha256-jYwzQkv1r7HN/4qrAuKp+NR4YYNp2xDrOX5O9YVqkWo=",
+        "narHash": "sha256-zF1iJkBQSDWmRO4/LEeHR1SpKY0lqZaxkoQJpPS9K9U=",
         "owner": "hyprwm",
         "repo": "aquamarine",
-        "rev": "a19cf76ee1a15c1c12083fa372747ce46387289f",
+        "rev": "9b5f14d9483445e766294eb8fbe0b8f370269ed0",
         "type": "github"
       },
       "original": {
@@ -33,47 +54,57 @@
         "type": "github"
       }
     },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
     "flake-compat": {
-      "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1696426674,
+        "lastModified": 1767039857,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
-        "owner": "edolstra",
+        "owner": "NixOS",
         "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
         "type": "github"
       },
       "original": {
-        "owner": "edolstra",
+        "owner": "NixOS",
         "repo": "flake-compat",
         "type": "github"
       }
     },
     "flake-parts": {
       "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib"
+        "nixpkgs-lib": [
+          "hermes-agent",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1743550720,
+        "lastModified": 1772408722,
-        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
+        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
+        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
         "type": "github"
       },
       "original": {
@@ -82,25 +113,26 @@
         "type": "github"
       }
     },
-    "gitignore": {
+    "hermes-agent": {
       "inputs": {
-        "nixpkgs": [
+        "flake-parts": "flake-parts",
-          "hyprland",
+        "nixpkgs": "nixpkgs_2",
-          "pre-commit-hooks",
+        "npm-lockfile-fix": "npm-lockfile-fix",
-          "nixpkgs"
+        "pyproject-build-systems": "pyproject-build-systems",
-        ]
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
       },
       "locked": {
-        "lastModified": 1709087332,
+        "lastModified": 1784644108,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "narHash": "sha256-WFwNw701EOVHRwEpgifbYQaT68LOxATKDTXaep82yN4=",
-        "owner": "hercules-ci",
+        "owner": "NousResearch",
-        "repo": "gitignore.nix",
+        "repo": "hermes-agent",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "rev": "d604141d097eec4a49493ad1eaceb9b2ca1e496d",
         "type": "github"
       },
       "original": {
-        "owner": "hercules-ci",
+        "owner": "NousResearch",
-        "repo": "gitignore.nix",
+        "repo": "hermes-agent",
         "type": "github"
       }
     },
@@ -111,11 +143,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747038076,
+        "lastModified": 1784601896,
-        "narHash": "sha256-vy+My+8yRRu0OG6XBEPDR8ebfrPS4iuruyQ1ZUyHq6s=",
+        "narHash": "sha256-rkpUOBv9pVG+GxhK90ebCrFpvjnfP4u2y/iGrzA42K4=",
         "owner": "feel-co",
         "repo": "hjem",
-        "rev": "7d674eaded6586554910e62baed5eadad6496315",
+        "rev": "35e95ebb9557ac41a72fe00dd55218d1a7f21679",
         "type": "github"
       },
       "original": {
@@ -126,19 +158,20 @@
     },
     "hjem-rum": {
       "inputs": {
-        "hjem": "hjem_2",
+        "hjem": [
-        "ndg": "ndg",
+          "hjem"
+        ],
+        "nix-darwin": "nix-darwin",
         "nixpkgs": [
           "nixpkgs"
-        ],
+        ]
-        "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1747217237,
+        "lastModified": 1784361899,
-        "narHash": "sha256-rYWxmjGpdGYlJd8gwripamC3t9mCihBDZJiz84CrUHI=",
+        "narHash": "sha256-QIzbnJIwy5cMYvPmLYPA4ar0lhficYLKZ6ytcHK90Uo=",
         "owner": "snugnug",
         "repo": "hjem-rum",
-        "rev": "1d3bf26bb71dced495a99e05a0141db24c49ca6f",
+        "rev": "73f6d1c01fe94e3de1cb3a84b9346da52f483c60",
         "type": "github"
       },
       "original": {
@@ -147,24 +180,24 @@
         "type": "github"
       }
     },
-    "hjem_2": {
+    "home-manager": {
       "inputs": {
         "nixpkgs": [
-          "hjem-rum",
+          "agenix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1746355589,
+        "lastModified": 1745494811,
-        "narHash": "sha256-LguszqsDBTtdBxblQTtN7vOAYmfoe43aHkB8aK1dChE=",
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
-        "owner": "feel-co",
+        "owner": "nix-community",
-        "repo": "hjem",
+        "repo": "home-manager",
-        "rev": "77b37eeb583d43e1c723119a69c906235174ce57",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
         "type": "github"
       },
       "original": {
-        "owner": "feel-co",
+        "owner": "nix-community",
-        "repo": "hjem",
+        "repo": "home-manager",
         "type": "github"
       }
     },
@@ -184,11 +217,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745948457,
+        "lastModified": 1776511930,
-        "narHash": "sha256-lzTV10FJTCGNtMdgW5YAhCAqezeAzKOd/97HbQK8GTU=",
+        "narHash": "sha256-fCpwFiTW0rT7oKJqr3cqHMnkwypSwQKpbtUEtxdkgrM=",
         "owner": "hyprwm",
         "repo": "hyprcursor",
-        "rev": "ac903e80b33ba6a88df83d02232483d99f327573",
+        "rev": "39435900785d0c560c6ae8777d29f28617d031ef",
         "type": "github"
       },
       "original": {
@@ -213,11 +246,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745015490,
+        "lastModified": 1782566056,
-        "narHash": "sha256-apEJ9zoSzmslhJ2vOKFcXTMZLUFYzh1ghfB6Rbw3Low=",
+        "narHash": "sha256-haEZcHzYrePnjFOYSWTbxm/Nrla0aPslJfmvdCvqtVc=",
         "owner": "hyprwm",
         "repo": "hyprgraphics",
-        "rev": "60754910946b4e2dc1377b967b7156cb989c5873",
+        "rev": "c6e7b9f673f4360bc813d3dc75028f75ee88d3f8",
         "type": "github"
       },
       "original": {
@@ -231,22 +264,23 @@
         "aquamarine": "aquamarine",
         "hyprcursor": "hyprcursor",
         "hyprgraphics": "hyprgraphics",
+        "hyprland-guiutils": "hyprland-guiutils",
         "hyprland-protocols": "hyprland-protocols",
-        "hyprland-qtutils": "hyprland-qtutils",
         "hyprlang": "hyprlang",
         "hyprutils": "hyprutils",
         "hyprwayland-scanner": "hyprwayland-scanner",
-        "nixpkgs": "nixpkgs",
+        "hyprwire": "hyprwire",
+        "nixpkgs": "nixpkgs_3",
         "pre-commit-hooks": "pre-commit-hooks",
-        "systems": "systems",
+        "systems": "systems_2",
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1746125293,
+        "lastModified": 1784641930,
-        "narHash": "sha256-uRNqLIZISbzdCi1NSuecT0bUgDv1oQYe7as5q+YYRgU=",
+        "narHash": "sha256-j1c/65skFvp1WPbHBlAfVWaeCz0Bgwr/WPwIg0H+Ncg=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "2670b8f7724e94020f21fe81483e69d73e1337cf",
+        "rev": "1a3606234c59842340ad9a42baeeffe44a9d6cda",
         "type": "github"
       },
       "original": {
@@ -255,6 +289,52 @@
         "type": "github"
       }
     },
+    "hyprland-guiutils": {
+      "inputs": {
+        "aquamarine": [
+          "hyprland",
+          "aquamarine"
+        ],
+        "hyprgraphics": [
+          "hyprland",
+          "hyprgraphics"
+        ],
+        "hyprlang": [
+          "hyprland",
+          "hyprlang"
+        ],
+        "hyprtoolkit": "hyprtoolkit",
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "hyprwayland-scanner": [
+          "hyprland",
+          "hyprwayland-scanner"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1784196523,
+        "narHash": "sha256-ahtKMGXFJdlQNhatQm1+BBU/pGfGYnAqQt3vWvq4p8s=",
+        "owner": "hyprwm",
+        "repo": "hyprland-guiutils",
+        "rev": "a6ccb6cb112ed5a244c0191fb972347ecfa893e0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprland-guiutils",
+        "type": "github"
+      }
+    },
     "hyprland-protocols": {
       "inputs": {
         "nixpkgs": [
@@ -267,11 +347,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743714874,
+        "lastModified": 1772460177,
-        "narHash": "sha256-yt8F7NhMFCFHUHy/lNjH/pjZyIDFNk52Q4tivQ31WFo=",
+        "narHash": "sha256-/6G/MsPvtn7bc4Y32pserBT/Z4SUUdBd4XYJpOEKVR4=",
         "owner": "hyprwm",
         "repo": "hyprland-protocols",
-        "rev": "3a5c2bda1c1a4e55cc1330c782547695a93f05b2",
+        "rev": "1cb6db5fd6bb8aee419f4457402fa18293ace917",
         "type": "github"
       },
       "original": {
@@ -280,74 +360,6 @@
         "type": "github"
       }
     },
-    "hyprland-qt-support": {
-      "inputs": {
-        "hyprlang": [
-          "hyprland",
-          "hyprland-qtutils",
-          "hyprlang"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "hyprland-qtutils",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "hyprland-qtutils",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1737634706,
-        "narHash": "sha256-nGCibkfsXz7ARx5R+SnisRtMq21IQIhazp6viBU8I/A=",
-        "owner": "hyprwm",
-        "repo": "hyprland-qt-support",
-        "rev": "8810df502cdee755993cb803eba7b23f189db795",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprland-qt-support",
-        "type": "github"
-      }
-    },
-    "hyprland-qtutils": {
-      "inputs": {
-        "hyprland-qt-support": "hyprland-qt-support",
-        "hyprlang": [
-          "hyprland",
-          "hyprlang"
-        ],
-        "hyprutils": [
-          "hyprland",
-          "hyprland-qtutils",
-          "hyprlang",
-          "hyprutils"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745951494,
-        "narHash": "sha256-2dModE32doiyQMmd6EDAQeZnz+5LOs6KXyE0qX76WIg=",
-        "owner": "hyprwm",
-        "repo": "hyprland-qtutils",
-        "rev": "4be1d324faf8d6e82c2be9f8510d299984dfdd2e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprland-qtutils",
-        "type": "github"
-      }
-    },
     "hyprlang": {
       "inputs": {
         "hyprutils": [
@@ -364,11 +376,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745357019,
+        "lastModified": 1777320127,
-        "narHash": "sha256-q/C3qj9FWHQenObXuw/nGIT8iIsWFjgmcQYcA+ZfpPs=",
+        "narHash": "sha256-Qu+Wf2Bp5qUjyn2YpZNq8a7JyzTGowhT1knrwE38a9U=",
         "owner": "hyprwm",
         "repo": "hyprlang",
-        "rev": "397600c42b8d7a443a5b4e92aa15f46650a90f18",
+        "rev": "090117506ddc3d7f26e650ff344d378c2ec329cc",
         "type": "github"
       },
       "original": {
@@ -377,6 +389,58 @@
         "type": "github"
       }
     },
+    "hyprtoolkit": {
+      "inputs": {
+        "aquamarine": [
+          "hyprland",
+          "hyprland-guiutils",
+          "aquamarine"
+        ],
+        "hyprgraphics": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprgraphics"
+        ],
+        "hyprlang": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprlang"
+        ],
+        "hyprutils": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprutils"
+        ],
+        "hyprwayland-scanner": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprwayland-scanner"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "hyprland-guiutils",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "hyprland-guiutils",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782554491,
+        "narHash": "sha256-+p3MlyN/nqRefcf2IckPlGRUn9+hielqpS9XClbLleM=",
+        "owner": "hyprwm",
+        "repo": "hyprtoolkit",
+        "rev": "bdba25ced39ea39ab004a8f31593ba0b0ff1ca35",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprtoolkit",
+        "type": "github"
+      }
+    },
     "hyprutils": {
       "inputs": {
         "nixpkgs": [
@@ -389,11 +453,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745975815,
+        "lastModified": 1784323413,
-        "narHash": "sha256-s3GzsRxBL/N/xYgUXZhQh4t62uR1BN4zxXgWBtJ3lWM=",
+        "narHash": "sha256-XnAVV+H4f8Xdv0yZcSwJ5kCjLyE8fHxPeLX6a3HSrAU=",
         "owner": "hyprwm",
         "repo": "hyprutils",
-        "rev": "05878d9470c9e5cbc8807813f9ec2006627a0ca0",
+        "rev": "5f03477ab3a005ff27c527486f551883535aea2f",
         "type": "github"
       },
       "original": {
@@ -414,11 +478,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1739870480,
+        "lastModified": 1777159683,
-        "narHash": "sha256-SiDN5BGxa/1hAsqhgJsS03C3t2QrLgBT8u+ENJ0Qzwc=",
+        "narHash": "sha256-Jxixw6wZphUp+nHYxOKUYSckL17QMBx2d5Zp0rJHr1g=",
         "owner": "hyprwm",
         "repo": "hyprwayland-scanner",
-        "rev": "206367a08dc5ac4ba7ad31bdca391d098082e64b",
+        "rev": "b8632713a6beaf28b56f2a7b0ab2fb7088dbb404",
         "type": "github"
       },
       "original": {
@@ -427,68 +491,111 @@
         "type": "github"
       }
     },
-    "ndg": {
+    "hyprwire": {
+      "inputs": {
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778410714,
+        "narHash": "sha256-o6RzFj4nJXaPRY7EM01siuCQeT41RfwwmcmFQqwFJJg=",
+        "owner": "hyprwm",
+        "repo": "hyprwire",
+        "rev": "85148a8e612808cf5ddb25d0b3c5840f3498a7dc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprwire",
+        "type": "github"
+      }
+    },
+    "nix-darwin": {
       "inputs": {
-        "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts",
         "nixpkgs": [
           "hjem-rum",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1746459301,
+        "lastModified": 1779036909,
-        "narHash": "sha256-QcAaxXdcPMqY5IppLa9fHCq3Rzq597DQqq8s2fKuE0k=",
+        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
-        "owner": "feel-co",
+        "owner": "nix-darwin",
-        "repo": "ndg",
+        "repo": "nix-darwin",
-        "rev": "2864a9901102a86db82157f72998809c570c36bb",
+        "rev": "56c666e108467d87d13508936aade6d567f2a501",
         "type": "github"
       },
       "original": {
-        "owner": "feel-co",
+        "owner": "nix-darwin",
-        "ref": "v2",
+        "repo": "nix-darwin",
-        "repo": "ndg",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1745930157,
+        "lastModified": 1754028485,
-        "narHash": "sha256-y3h3NLnzRSiUkYpnfvnS669zWZLoqqI6NprtLQ+5dck=",
+        "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "46e634be05ce9dc6d4db8e664515ba10b78151ae",
+        "rev": "59e69648d345d6e8fef86158c555730fa12af9de",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-25.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nixpkgs-lib": {
-      "locked": {
-        "lastModified": 1743296961,
-        "narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1745930157,
+        "lastModified": 1775036866,
-        "narHash": "sha256-y3h3NLnzRSiUkYpnfvnS669zWZLoqqI6NprtLQ+5dck=",
+        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1784356753,
+        "narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "61b7c44c4073f0b827768aff0049561b5110ea5a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1784497964,
+        "narHash": "sha256-vlHUuqAcbcH2RKmHbPiuQzbv1pnzzavXnI62RD0bqCU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "46e634be05ce9dc6d4db8e664515ba10b78151ae",
+        "rev": "241313f4e8e508cb9b13278c2b0fa25b9ca27163",
         "type": "github"
       },
       "original": {
@@ -498,21 +605,41 @@
         "type": "github"
       }
     },
+    "npm-lockfile-fix": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes-agent",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1775903712,
+        "narHash": "sha256-2GV79U6iVH4gKAPWYrxUReB0S41ty/Y3dBLquU8AlaA=",
+        "owner": "jeslie0",
+        "repo": "npm-lockfile-fix",
+        "rev": "c6093acb0c0548e0f9b8b3d82918823721930fe8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "jeslie0",
+        "repo": "npm-lockfile-fix",
+        "type": "github"
+      }
+    },
     "pre-commit-hooks": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat",
-        "gitignore": "gitignore",
         "nixpkgs": [
           "hyprland",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1742649964,
+        "lastModified": 1784288435,
-        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
+        "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
+        "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9",
         "type": "github"
       },
       "original": {
@@ -521,15 +648,82 @@
         "type": "github"
       }
     },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes-agent",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "hermes-agent",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "hermes-agent",
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772555609,
+        "narHash": "sha256-3BA3HnUvJSbHJAlJj6XSy0Jmu7RyP2gyB/0fL7XuEDo=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "c37f66a953535c394244888598947679af231863",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes-agent",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772865871,
+        "narHash": "sha256-/ZTSg97aouL0SlPHaokA4r3iuH9QzHVuWPACD2CUCFY=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "e537db02e72d553cea470976b9733581bcf5b3ed",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
+        "agenix": "agenix",
+        "hermes-agent": "hermes-agent",
         "hjem": "hjem",
         "hjem-rum": "hjem-rum",
         "hyprland": "hyprland",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs_4"
       }
     },
     "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
       "locked": {
         "lastModified": 1689347949,
         "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
@@ -544,24 +738,28 @@
         "type": "github"
       }
     },
-    "treefmt-nix": {
+    "uv2nix": {
       "inputs": {
         "nixpkgs": [
-          "hjem-rum",
+          "hermes-agent",
           "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "hermes-agent",
+          "pyproject-nix"
         ]
       },
       "locked": {
-        "lastModified": 1746216483,
+        "lastModified": 1773039484,
-        "narHash": "sha256-4h3s1L/kKqt3gMDcVfN8/4v2jqHrgLIe4qok4ApH5x4=",
+        "narHash": "sha256-+boo33KYkJDw9KItpeEXXv8+65f7hHv/earxpcyzQ0I=",
-        "owner": "numtide",
+        "owner": "pyproject-nix",
-        "repo": "treefmt-nix",
+        "repo": "uv2nix",
-        "rev": "29ec5026372e0dec56f890e50dbe4f45930320fd",
+        "rev": "b68be7cfeacbed9a3fa38a2b5adc0cfb81d9bb1f",
         "type": "github"
       },
       "original": {
-        "owner": "numtide",
+        "owner": "pyproject-nix",
-        "repo": "treefmt-nix",
+        "repo": "uv2nix",
         "type": "github"
       }
     },
@@ -593,11 +791,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745871725,
+        "lastModified": 1784371182,
-        "narHash": "sha256-M24SNc2flblWGXFkGQfqSlEOzAGZnMc9QG3GH4K/KbE=",
+        "narHash": "sha256-S8A1lezEalltWcCp3gAic5lssS0xTSISK6fKODefhOk=",
         "owner": "hyprwm",
         "repo": "xdg-desktop-portal-hyprland",
-        "rev": "76bbf1a6b1378e4ab5230bad00ad04bc287c969e",
+        "rev": "08d99f727944dd15e4740090305e31c5fb92a50a",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,7 +1,10 @@
 {
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+
     hyprland.url = "github:hyprwm/Hyprland";
+    hermes-agent.url = "github:NousResearch/hermes-agent";
+    agenix.url = "github:ryantm/agenix";
 
     hjem = {
       url = "github:feel-co/hjem";
@@ -11,26 +14,39 @@
     hjem-rum = {
       url = "github:snugnug/hjem-rum";
       inputs.nixpkgs.follows = "nixpkgs";
+      inputs.hjem.follows = "hjem";
     };
   };
 
   outputs =
-    { self, nixpkgs, ... }@inputs:
+    {
+      self,
+      nixpkgs,
+      ...
+    }@inputs:
     let
       system = "x86_64-linux";
       username = "poslop";
+      mkHost =
+        host: modules:
+        nixpkgs.lib.nixosSystem {
+          modules = [ { nixpkgs.hostPlatform = system; } ] ++ modules;
+          specialArgs = {
+            inherit
+              self
+              inputs
+              username
+              host
+              ;
+          };
+        };
     in
     {
       nixosConfigurations = {
-        nixos-vm2 = nixpkgs.lib.nixosSystem {
+        nixos-vm2 = mkHost "nixos-vm2" [ ./hosts/nixos-vm2/configuration.nix ];
-          inherit system;
+        qemu-vm = mkHost "qemu-vm" [ ./hosts/qemu-vm/configuration.nix ];
-          modules = [ ./hosts/nixos-vm2/configuration.nix ];
+        goyplex-vm = mkHost "goyplex-vm" [ ./hosts/goyplex-vm/configuration.nix ];
-          specialArgs = {
+        hermes-vm = mkHost "hermes-vm" [ ./hosts/hermes-vm/configuration.nix ];
-            host = "nixos-vm2";
-            inherit self inputs username;
-          };
-        };
       };
-
     };
 }

hosts/goyplex-vm/configuration.nix

@@ -0,0 +1,19 @@
+{ pkgs, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules
+    ../../modules/k3s/k3s.nix
+  ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  services.spice-vdagentd.enable = true;
+  services.qemuGuest.enable = true;
+
+  system.stateVersion = "25.11";
+}

hosts/goyplex-vm/hardware-configuration.nix

@@ -2,33 +2,46 @@
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 {
+  config,
   lib,
+  pkgs,
   modulesPath,
   ...
 }:
 
 {
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
 
   boot.initrd.availableKernelModules = [
+    "uhci_hcd"
+    "ehci_pci"
     "ahci"
-    "xhci_pci"
     "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
     "sr_mod"
-    "virtio_blk"
   ];
   boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
+  boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" = {
-    device = "/dev/disk/by-uuid/39b3801f-ffcd-421f-966f-46625fb8d4ca";
+    device = "/dev/disk/by-uuid/4a546e61-4a4d-4e09-8b00-3f56acc14ccb";
     fsType = "ext4";
   };
 
-  swapDevices = [ { device = "/dev/disk/by-uuid/7043d338-93f0-40a7-9033-6616685e32f3"; } ];
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/C838-5FC2";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
 
-  networking.useDHCP = lib.mkDefault true;
+  swapDevices = [ ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

hosts/hermes-vm/configuration.nix

@@ -0,0 +1,19 @@
+{ pkgs, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules
+    ../../modules/hermes
+  ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  services.spice-vdagentd.enable = true;
+  services.qemuGuest.enable = true;
+
+  system.stateVersion = "25.11";
+}

hosts/hermes-vm/hardware-configuration.nix

@@ -0,0 +1,47 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "uhci_hcd"
+    "ehci_pci"
+    "ahci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/4a546e61-4a4d-4e09-8b00-3f56acc14ccb";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/C838-5FC2";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/nixos-vm1/configuration.nix

@@ -1,42 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-
-{
-  nix.settings = {
-    experimental-features = "nix-command flakes";
-  };
-
-  imports = [
-    ./hardware-configuration.nix
-    ./modules
-  ];
-
-  programs.hyprland.enable = true;
-
-  boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/vda";
-  networking.hostName = "poslop-nixvm";
-  networking.networkmanager.enable = true;
-
-  time.timeZone = "America/Chicago";
-
-  services.printing.enable = true;
-
-  services.pipewire = {
-    enable = true;
-    pulse.enable = true;
-  };
-
-  environment.systemPackages = with pkgs; [
-    kitty
-    vim
-    wget
-    git
-    curl
-    zsh
-  ];
-
-  system.stateVersion = "24.11";
-}

hosts/nixos-vm2/configuration.nix

@@ -8,10 +8,8 @@
     ../../modules
   ];
 
-  programs.hyprland.enable = true;
-
   boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/vda";
+  boot.loader.grub.device = "/dev/sda";
 
   services.spice-vdagentd.enable = true;
   services.qemuGuest.enable = true;

hosts/nixos-vm2/hardware-configuration.nix

@@ -1,39 +1,25 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
+{ config, lib, pkgs, modulesPath, ... }:
-  lib,
-  modulesPath,
-  ...
-}:
 
 {
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  imports = [ ];
 
-  boot.initrd.availableKernelModules = [
+  boot.initrd.availableKernelModules = [ "ata_piix" "ohci_pci" "ehci_pci" "ahci" "sd_mod" "sr_mod" ];
-    "ahci"
-    "xhci_pci"
-    "virtio_pci"
-    "sr_mod"
-    "virtio_blk"
-  ];
   boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
+  boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" = {
+  fileSystems."/" =
-    device = "/dev/disk/by-uuid/b8c66f3c-759d-4d4f-9d1a-3f2e04d91e23";
+    { device = "/dev/disk/by-uuid/8762fc76-e399-4d11-adb9-377841204c4b";
-    fsType = "ext4";
+      fsType = "ext4";
-  };
+    };
 
-  swapDevices = [ { device = "/dev/disk/by-uuid/b7d73851-7f85-44fa-b62a-e35deb0ea98a"; } ];
+  swapDevices =
-
+    [ { device = "/dev/disk/by-uuid/94573296-7dcb-423f-a882-342b98b8147a"; }
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+    ];
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  virtualisation.virtualbox.guest.enable = true;
 }

hosts/qemu-vm/configuration.nix

@@ -0,0 +1,18 @@
+{
+  ...
+}:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules
+  ];
+
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/vda";
+
+  services.spice-vdagentd.enable = true;
+  services.qemuGuest.enable = true;
+
+  system.stateVersion = "24.11";
+}

hosts/qemu-vm/hardware-configuration.nix

@@ -0,0 +1,33 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/b8c66f3c-759d-4d4f-9d1a-3f2e04d91e23";
+      fsType = "ext4";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/b7d73851-7f85-44fa-b62a-e35deb0ea98a"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp8s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

modules/core/default.nix

@@ -1,11 +1,13 @@
 {
   imports = [
+    ./nvim.nix
+    ./zsh
+    ./git.nix
     ./hjem.nix
     ./network.nix
-    ./packages.nix
+    ./packages
     ./timezone.nix
     ./nix.nix
-    ./pipewire.nix
     ./program.nix
     ./user.nix
     ./ssh.nix

modules/core/git.nix

@@ -1,8 +1,3 @@
-{
-  config,
-  username,
-  ...
-}:
 {
   hj.rum.programs.git = {
     enable = true;
@@ -11,6 +6,12 @@
         name = "poslop";
         email = "poslop@archfox.org";
       };
+      core = {
+        editor = "nvim -f";
+      };
+      credential = {
+        helper = "store";
+      };
     };
   };
 }

modules/core/network.nix

@@ -1,4 +1,6 @@
+{ host, ... }:
+
 {
-  networking.hostName = "poslop-nixvm2";
+  networking.hostName = host;
   networking.networkmanager.enable = true;
 }

modules/core/nvim.nix

@@ -0,0 +1,26 @@
+{ pkgs, ... }:
+
+{
+  environment.variables.EDITOR = "nvim";
+
+  systemd.user.services."nvim-config" = {
+    description = "Clone Neovim config into ~/.config/nvim";
+    after = [ "network.target" ];
+    wantedBy = [ "default.target" ];
+    enable = true;
+    serviceConfig = {
+      Type = "oneshot";
+    };
+
+    script = ''
+      set -e
+
+      if [ ! -d "$HOME/.config/nvim/.git" ]; then
+        echo "Cloning Neovim config..."
+        ${pkgs.git}/bin/git clone https://git.archfox.org/poslop/nvbad.git "$HOME/.config/nvim"
+      else
+        echo "Neovim config already exists, skipping."
+      fi
+    '';
+  };
+}

modules/core/packages/default.nix

@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./dev.nix
+    ./system.nix
+    ./utils.nix
+  ];
+}

modules/core/packages/dev.nix

@@ -0,0 +1,19 @@
+{ pkgs, username, ... }:
+{
+  hjem.users.${username}.packages = with pkgs; [
+    # general
+    neovim
+    git
+    tree-sitter
+    gcc
+
+    # lua
+    stylua
+    lua-language-server
+
+    # nix
+    nixd
+    nixfmt
+    statix
+  ];
+}

modules/core/packages/system.nix

@@ -1,12 +1,7 @@
 { pkgs, ... }:
 {
   environment.systemPackages = with pkgs; [
-    wl-clipboard
-    kitty
-    vim
-    wget
-    git
-    curl
     zsh
   ];
+
 }

modules/core/packages/utils.nix

@@ -0,0 +1,11 @@
+{ pkgs, username, ... }:
+{
+  hjem.users.${username}.packages = with pkgs; [
+    btop
+    curl
+    tlrc
+    unzip
+    wget
+    wl-clipboard
+  ];
+}

modules/core/program.nix

@@ -1,4 +1,7 @@
 _:
 {
-  programs.zsh.enable = true;
+  programs = {
+    zsh.enable = true;
+    nix-ld.enable = true; 
+  };
 }

modules/core/user.nix

@@ -4,7 +4,10 @@
   users.users.${username} = {
     isNormalUser = true;
     description = "${username}";
-    extraGroups = [ "wheel" ];
+    extraGroups = [
+      "wheel"
+      "docker"
+    ];
     shell = pkgs.zsh;
   };
   nix.settings.allowed-users = [ "@wheel" ];

modules/core/zsh/.zshrc

@@ -0,0 +1,44 @@
+
+HISTFILE=~/.histfile
+HISTSIZE=1000
+SAVEHIST=10000
+setopt autocd extendedglob nomatch notify
+unsetopt beep
+bindkey -v
+
+zstyle :compinstall filename '/home/poslop/.zshrc'
+
+autoload -Uz compinit
+compinit
+
+alias gc='git commit'
+alias gp='git push'
+alias gs='git status'
+
+alias hermes='docker exec -it -u hermes hermes-agent /data/current-package/bin/hermes'
+
+alias hermes-age='cd /etc/rice-flakes/modules/hermes/secrets && sudo EDITOR=nvim agenix -e ./hermes-env.age -i /etc/ssh/ssh_host_ed25519_key'
+
+ga() {
+  if [[ -z "$1" ]]; then
+    git add -u
+  else
+    git add "$1"
+  fi
+}
+
+rerice() {
+  local flake_dir="/etc/rice-flakes"
+  local host="$(hostname -s)"
+  local OPTIND=1
+
+  while getopts ":h:" opt; do
+    case $opt in
+      h) host="$OPTARG" ;;
+      :) echo "Option -$OPTARG requires an argument." >&2; return 1 ;;
+      \?) echo "Unknown option: -$OPTARG" >&2; return 1 ;;
+    esac
+  done
+
+  sudo nixos-rebuild switch --flake "${flake_dir}#${host}"
+}

modules/core/zsh/zsh.nix

@@ -0,0 +1,7 @@
+{
+  hj = {
+    files = {
+      ".zshrc".source = ./.zshrc;
+    };
+  };
+}

modules/hermes/default.nix

@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./sudo.nix
+    ./hermes.nix
+    ./secrets
+  ];
+}

modules/hermes/hermes.nix

@@ -0,0 +1,63 @@
+{
+  inputs,
+  config,
+  ...
+}:
+
+{
+  imports = [ inputs.hermes-agent.nixosModules.default ];
+
+  services.hermes-agent = {
+    enable = true;
+    addToSystemPackages = true;
+    environmentFiles = [
+      config.age.secrets.hermes-env.path
+    ];
+
+    container = {
+      image = "debian:bookworm";
+      backend = "docker";
+      enable = true;
+      hostUsers = [ "poslop" ];
+      extraOptions = [
+        "-p"
+        "9119:9119"
+        "-p"
+        "8642:8642"
+      ];
+    };
+
+    settings = {
+      approvals = {
+        mode = "off";
+        cron_mode = "deny";
+        mcp_reload_confirm = "false";
+      };
+
+      memory = {
+        memory_enabled = true;
+        user_profile_enabled = true;
+      };
+
+      display = {
+        credits_notices = true;
+      };
+
+      delegation = {
+        model = "openai/gpt-5.6-luna";
+        provider = "nous";
+      };
+
+      discord = {
+        group_sessions_per_user = false;
+        reactions = false;
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    8080
+    9119
+    8642
+  ];
+}

modules/hermes/secrets/agenix.nix

@@ -0,0 +1,15 @@
+{
+  inputs,
+  pkgs,
+  username,
+  ...
+}:
+
+{
+  imports = [ inputs.agenix.nixosModules.default ];
+  age.secrets."hermes-env".file = ./hermes-env.age;
+
+  hjem.users.${username}.packages = with pkgs; [
+    inputs.agenix.packages."${system}".default
+  ];
+}

modules/hermes/secrets/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./agenix.nix
+  ];
+}

modules/hermes/secrets/secrets.nix

@@ -0,0 +1,6 @@
+let
+  hermes-vm = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFqtbtEYL4pPNvJV64FjDXT6zT2ew0IFK8XHJ9LP7ae";
+in
+{
+  "hermes-env.age".publicKeys = [ hermes-vm ];
+}

modules/hermes/sudo.nix

@@ -0,0 +1,13 @@
+{
+  security.sudo.extraRules = [
+    {
+      users = [ "poslop" ];
+      commands = [
+        {
+          command = "/run/current-system/sw/bin/docker";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+}

modules/home/default.nix

@@ -1,9 +1,8 @@
 {
   imports = [
     ./hyprland
-    ./zsh
+    ./pipewire.nix
-    ./git.nix
     ./packages.nix
-    ./neovim.nix
+    ./fonts.nix
   ];
 }

modules/home/fonts.nix

@@ -0,0 +1,6 @@
+{ pkgs, ... }:
+{
+  fonts.packages = with pkgs; [
+    nerd-fonts.martian-mono
+  ];
+}

modules/home/hyprland/default.nix

@@ -1,5 +1,5 @@
 {
   imports = [
-    #./monitor.nix
+    ./hyprland.nix
   ];
 }

modules/home/hyprland/hypr/hyprland.conf

@@ -0,0 +1,238 @@
+monitor=,preferred,auto,auto
+
+$terminal = kitty
+$fileManager = dolphin
+$menu = wofi --show drun
+
+# exec-once = $terminal
+# exec-once = nm-applet &
+# exec-once = waybar & hyprpaper & firefox
+
+env = XCURSOR_SIZE,24
+env = HYPRCURSOR_SIZE,24
+
+general {
+    gaps_in = 5
+    gaps_out = 20
+
+    border_size = 2
+
+    # https://wiki.hyprland.org/Configuring/Variables/#variable-types for info about colors
+    col.active_border = rgba(33ccffee) rgba(00ff99ee) 45deg
+    col.inactive_border = rgba(595959aa)
+
+    # Set to true enable resizing windows by clicking and dragging on borders and gaps
+    resize_on_border = false
+
+    # Please see https://wiki.hyprland.org/Configuring/Tearing/ before you turn this on
+    allow_tearing = false
+
+    layout = dwindle
+}
+
+# https://wiki.hyprland.org/Configuring/Variables/#decoration
+decoration {
+    rounding = 10
+    rounding_power = 2
+
+    # Change transparency of focused and unfocused windows
+    active_opacity = 1.0
+    inactive_opacity = 1.0
+
+    shadow {
+        enabled = true
+        range = 4
+        render_power = 3
+        color = rgba(1a1a1aee)
+    }
+
+    # https://wiki.hyprland.org/Configuring/Variables/#blur
+    blur {
+        enabled = true
+        size = 3
+        passes = 1
+
+        vibrancy = 0.1696
+    }
+}
+
+# https://wiki.hyprland.org/Configuring/Variables/#animations
+animations {
+    enabled = yes, please :)
+
+    # Default animations, see https://wiki.hyprland.org/Configuring/Animations/ for more
+
+    bezier = easeOutQuint,0.23,1,0.32,1
+    bezier = easeInOutCubic,0.65,0.05,0.36,1
+    bezier = linear,0,0,1,1
+    bezier = almostLinear,0.5,0.5,0.75,1.0
+    bezier = quick,0.15,0,0.1,1
+
+    animation = global, 1, 10, default
+    animation = border, 1, 5.39, easeOutQuint
+    animation = windows, 1, 4.79, easeOutQuint
+    animation = windowsIn, 1, 4.1, easeOutQuint, popin 87%
+    animation = windowsOut, 1, 1.49, linear, popin 87%
+    animation = fadeIn, 1, 1.73, almostLinear
+    animation = fadeOut, 1, 1.46, almostLinear
+    animation = fade, 1, 3.03, quick
+    animation = layers, 1, 3.81, easeOutQuint
+    animation = layersIn, 1, 4, easeOutQuint, fade
+    animation = layersOut, 1, 1.5, linear, fade
+    animation = fadeLayersIn, 1, 1.79, almostLinear
+    animation = fadeLayersOut, 1, 1.39, almostLinear
+    animation = workspaces, 1, 1.94, almostLinear, fade
+    animation = workspacesIn, 1, 1.21, almostLinear, fade
+    animation = workspacesOut, 1, 1.94, almostLinear, fade
+}
+
+# Ref https://wiki.hyprland.org/Configuring/Workspace-Rules/
+# "Smart gaps" / "No gaps when only"
+# uncomment all if you wish to use that.
+# workspace = w[tv1], gapsout:0, gapsin:0
+# workspace = f[1], gapsout:0, gapsin:0
+# windowrule = bordersize 0, floating:0, onworkspace:w[tv1]
+# windowrule = rounding 0, floating:0, onworkspace:w[tv1]
+# windowrule = bordersize 0, floating:0, onworkspace:f[1]
+# windowrule = rounding 0, floating:0, onworkspace:f[1]
+
+# See https://wiki.hyprland.org/Configuring/Dwindle-Layout/ for more
+dwindle {
+    pseudotile = true # Master switch for pseudotiling. Enabling is bound to mainMod + P in the keybinds section below
+    preserve_split = true # You probably want this
+}
+
+# See https://wiki.hyprland.org/Configuring/Master-Layout/ for more
+master {
+    new_status = master
+}
+
+# https://wiki.hyprland.org/Configuring/Variables/#misc
+misc {
+    force_default_wallpaper = -1 # Set to 0 or 1 to disable the anime mascot wallpapers
+    disable_hyprland_logo = false # If true disables the random hyprland logo / anime girl background. :(
+}
+
+
+#############
+### INPUT ###
+#############
+
+# https://wiki.hyprland.org/Configuring/Variables/#input
+input {
+    kb_layout = us
+    kb_variant =
+    kb_model =
+    kb_options =
+    kb_rules =
+
+    follow_mouse = 1
+
+    sensitivity = 0 # -1.0 - 1.0, 0 means no modification.
+
+    touchpad {
+        natural_scroll = false
+    }
+}
+
+# https://wiki.hyprland.org/Configuring/Variables/#gestures
+gestures {
+    workspace_swipe = false
+}
+
+# Example per-device config
+# See https://wiki.hyprland.org/Configuring/Keywords/#per-device-input-configs for more
+device {
+    name = epic-mouse-v1
+    sensitivity = -0.5
+}
+
+
+###################
+### KEYBINDINGS ###
+###################
+
+# See https://wiki.hyprland.org/Configuring/Keywords/
+$mainMod = SUPER # Sets "Windows" key as main modifier
+
+# Example binds, see https://wiki.hyprland.org/Configuring/Binds/ for more
+bind = $mainMod, Return, exec, $terminal
+bind = $mainMod, C, killactive,
+bind = $mainMod, M, exit,
+bind = $mainMod, E, exec, $fileManager
+bind = $mainMod, V, togglefloating,
+bind = $mainMod, R, exec, $menu
+bind = $mainMod, P, pseudo, # dwindle
+bind = $mainMod, J, togglesplit, # dwindle
+
+# Move focus with mainMod + arrow keys
+bind = $mainMod, left, movefocus, l
+bind = $mainMod, right, movefocus, r
+bind = $mainMod, up, movefocus, u
+bind = $mainMod, down, movefocus, d
+
+# Switch workspaces with mainMod + [0-9]
+bind = $mainMod, 1, workspace, 1
+bind = $mainMod, 2, workspace, 2
+bind = $mainMod, 3, workspace, 3
+bind = $mainMod, 4, workspace, 4
+bind = $mainMod, 5, workspace, 5
+bind = $mainMod, 6, workspace, 6
+bind = $mainMod, 7, workspace, 7
+bind = $mainMod, 8, workspace, 8
+bind = $mainMod, 9, workspace, 9
+bind = $mainMod, 0, workspace, 10
+
+# Move active window to a workspace with mainMod + SHIFT + [0-9]
+bind = $mainMod SHIFT, 1, movetoworkspace, 1
+bind = $mainMod SHIFT, 2, movetoworkspace, 2
+bind = $mainMod SHIFT, 3, movetoworkspace, 3
+bind = $mainMod SHIFT, 4, movetoworkspace, 4
+bind = $mainMod SHIFT, 5, movetoworkspace, 5
+bind = $mainMod SHIFT, 6, movetoworkspace, 6
+bind = $mainMod SHIFT, 7, movetoworkspace, 7
+bind = $mainMod SHIFT, 8, movetoworkspace, 8
+bind = $mainMod SHIFT, 9, movetoworkspace, 9
+bind = $mainMod SHIFT, 0, movetoworkspace, 10
+
+# Example special workspace (scratchpad)
+bind = $mainMod, S, togglespecialworkspace, magic
+bind = $mainMod SHIFT, S, movetoworkspace, special:magic
+
+# Scroll through existing workspaces with mainMod + scroll
+bind = $mainMod, mouse_down, workspace, e+1
+bind = $mainMod, mouse_up, workspace, e-1
+
+# Move/resize windows with mainMod + LMB/RMB and dragging
+bindm = $mainMod, mouse:272, movewindow
+bindm = $mainMod, mouse:273, resizewindow
+
+# Laptop multimedia keys for volume and LCD brightness
+bindel = ,XF86AudioRaiseVolume, exec, wpctl set-volume -l 1 @DEFAULT_AUDIO_SINK@ 5%+
+bindel = ,XF86AudioLowerVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-
+bindel = ,XF86AudioMute, exec, wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle
+bindel = ,XF86AudioMicMute, exec, wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle
+bindel = ,XF86MonBrightnessUp, exec, brightnessctl s 10%+
+bindel = ,XF86MonBrightnessDown, exec, brightnessctl s 10%-
+
+# Requires playerctl
+bindl = , XF86AudioNext, exec, playerctl next
+bindl = , XF86AudioPause, exec, playerctl play-pause
+bindl = , XF86AudioPlay, exec, playerctl play-pause
+bindl = , XF86AudioPrev, exec, playerctl previous
+
+##############################
+### WINDOWS AND WORKSPACES ###
+##############################
+
+# See https://wiki.hyprland.org/Configuring/Window-Rules/ for more
+# See https://wiki.hyprland.org/Configuring/Workspace-Rules/ for workspace rules
+
+# Example windowrule
+# windowrule = float,class:^(kitty)$,title:^(kitty)$
+
+# Ignore maximize requests from apps. You'll probably like this.
+windowrule = suppressevent maximize, class:.*
+
+# Fix some dragging issues with XWayland
+windowrule = nofocus,class:^$,title:^$,xwayland:1,floating:1,fullscreen:0,pinned:0

modules/home/hyprland/hyprland.nix

@@ -1 +1,10 @@
-{ programs.hyprland.enable = true; }
+{
+  programs.hyprland.enable = true;
+  hj = {
+    rum.desktops.hyprland.enable = true;
+
+    files = {
+      ".config/hypr".source = ./hypr;
+    };
+  };
+}

modules/home/hyprland/monitor.nix

@@ -1 +0,0 @@
-{ config.me.rum.programs.hyprland.settings.monitor = [ ", 1920x1080@60, auto, 1" ]; }

modules/home/neovim.nix

@@ -1,8 +0,0 @@
-_:
-{
-  programs.neovim = {
-    enable = true;
-    vimAlias = true;
-    viAlias = true;
-  };
-}

modules/home/packages.nix

@@ -6,16 +6,7 @@
 
 {
   hjem.users.${username}.packages = with pkgs; [
-    statix
-    git
-    zsh
-    neofetch
-    btop
-    wl-clipboard
     kitty
-    vim
-    wget
-    curl
     foot
   ];
 }

modules/home/ssh.nix

@@ -1,6 +0,0 @@
-_:
-{
-  services.openssh = {
-    enable = true;
-  };
-}

modules/home/zsh/zsh.nix

@@ -1,6 +0,0 @@
-{ username, ... }:
-{
-  config.hjem.users.${username}.rum.programs.zsh = {
-    enable = true;
-  };
-}

modules/k3s/k3s.nix

@@ -0,0 +1,22 @@
+{
+  networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ];
+  networking.firewall.allowedUDPPorts = [ 3479 ];
+
+  services.k3s = {
+    enable = true;
+    role = "server";
+    extraFlags = "--write-kubeconfig-mode 644";
+    manifests = {
+      traefik-namespace    = { source = ./traefik/namespace.yaml; };
+      traefik-rbac         = { source = ./traefik/rbac.yaml; };
+      traefik-pvc          = { source = ./traefik/pvc.yaml; };
+      traefik-deployment   = { source = ./traefik/deployment.yaml; };
+      traefik-service      = { source = ./traefik/service.yaml; };
+      netbird-namespace    = { source = ./netbird/namespace.yaml; };
+      netbird-config       = { source = ./netbird/config.yaml; };
+      netbird-server       = { source = ./netbird/server.yaml; };
+      netbird-dashboard    = { source = ./netbird/dashboard.yaml; };
+      netbird-ingress      = { source = ./netbird/ingress.yaml; };
+    };
+  };
+}

modules/k3s/netbird/config.yaml

@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: netbird-server-config
+  namespace: netbird
+data:
+  config.yaml: |
+    server:
+      listenAddress: ":80"
+      exposedAddress: "https://netbird.archfox.org:443"
+      metricsPort: 9090
+      healthcheckAddress: ":9000"
+      logLevel: "info"
+      logFile: "console"
+      stunPorts:
+        - 3479
+      tls:
+        certFile: ""
+        keyFile: ""
+        letsencrypt:
+          enabled: false
+          dataDir: ""
+          domains: []
+          email: ""
+          awsRoute53: false
+      authSecret: "182c13eec94ba6ef89ce8f3e33b4694b051fe4b0bf6d2c9188f738d1c000b6d7"
+      dataDir: "/var/lib/netbird/"
+      disableAnonymousMetrics: false
+      disableGeoliteUpdate: false
+      auth:
+        issuer: "https://netbird.archfox.org/oauth2"
+        localAuthDisabled: false
+        signKeyRefreshEnabled: true
+        dashboardRedirectURIs:
+          - "https://netbird.archfox.org/nb-auth"
+          - "https://netbird.archfox.org/nb-silent-auth"
+        cliRedirectURIs:
+          - "http://localhost:53000/"
+      store:
+        engine: "sqlite"
+        dsn: ""
+        encryptionKey: ""
+      reverseProxy:
+        trustedHTTPProxies:
+          - "10.0.1.45/32"

modules/k3s/netbird/dashboard.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dashboard
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dashboard
+  template:
+    metadata:
+      labels:
+        app: dashboard
+    spec:
+      containers:
+        - name: dashboard
+          image: netbirdio/dashboard:latest
+          ports:
+            - containerPort: 80
+          env:
+            - name: NETBIRD_MGMT_API_ENDPOINT
+              value: "https://netbird.archfox.org"
+            - name: NETBIRD_MGMT_GRPC_API_ENDPOINT
+              value: "https://netbird.archfox.org"
+            - name: AUTH_AUDIENCE
+              value: "netbird-dashboard"
+            - name: AUTH_CLIENT_ID
+              value: "netbird-dashboard"
+            - name: AUTH_CLIENT_SECRET
+              value: ""
+            - name: AUTH_AUTHORITY
+              value: "https://netbird.archfox.org/oauth2"
+            - name: USE_AUTH0
+              value: "false"
+            - name: AUTH_SUPPORTED_SCOPES
+              value: "openid profile email groups"
+            - name: AUTH_REDIRECT_URI
+              value: "/nb-auth"
+            - name: AUTH_SILENT_REDIRECT_URI
+              value: "/nb-silent-auth"
+            - name: LETSENCRYPT_DOMAIN
+              value: "none"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dashboard
+  namespace: netbird
+spec:
+  selector:
+    app: dashboard
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80

modules/k3s/netbird/ingress.yaml

@@ -0,0 +1,26 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netbird
+  namespace: netbird
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/management.ManagementService/`) || PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ProxyService/`))
+      kind: Rule
+      services:
+        - name: netbird-server
+          port: 80
+          scheme: h2c
+    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
+      kind: Rule
+      services:
+        - name: netbird-server
+          port: 80
+    - match: Host(`netbird.archfox.org`)
+      kind: Rule
+      priority: 1
+      services:
+        - name: dashboard
+          port: 80

modules/k3s/netbird/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netbird

modules/k3s/netbird/server.yaml

@@ -0,0 +1,74 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netbird-server
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netbird-server
+  template:
+    metadata:
+      labels:
+        app: netbird-server
+    spec:
+      containers:
+        - name: netbird-server
+          image: netbirdio/netbird-server:latest
+          args: ["--config", "/etc/netbird/config.yaml"]
+          ports:
+            - containerPort: 80
+            - containerPort: 3479
+              protocol: UDP
+            - containerPort: 33073
+          env:
+            - name: NETBIRD_STORE_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: netbird-encryption
+                  key: encryptionKey
+          volumeMounts:
+            - name: config
+              mountPath: /etc/netbird
+            - name: data
+              mountPath: /var/lib/netbird
+      volumes:
+        - name: config
+          configMap:
+            name: netbird-server-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: netbird-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: netbird-data
+  namespace: netbird
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbird-server
+  namespace: netbird
+spec:
+  selector:
+    app: netbird-server
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+    - name: grpc-compat
+      port: 33073
+      targetPort: 33073
+    - name: stun
+      port: 3479
+      targetPort: 3479
+      protocol: UDP

modules/k3s/traefik/deployment.yaml

@@ -0,0 +1,35 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: traefik
+  template:
+    metadata:
+      labels:
+        app: traefik
+    spec:
+      serviceAccountName: traefik
+      containers:
+        - name: traefik
+          image: traefik:v3.4
+          args:
+            - --log.level=INFO
+            - --api.dashboard=true
+            - --entrypoints.web.address=:80
+            - --providers.kubernetescrd=true
+            - --providers.kubernetesingress=true
+          ports:
+            - name: web
+              containerPort: 80
+          volumeMounts:
+            - name: acme-storage
+              mountPath: /data
+      volumes:
+        - name: acme-storage
+          persistentVolumeClaim:
+            claimName: traefik-acme

modules/k3s/traefik/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik

modules/k3s/traefik/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: traefik-acme
+  namespace: traefik
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 128Mi

modules/k3s/traefik/rbac.yaml

@@ -0,0 +1,41 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: traefik
+  namespace: traefik
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: traefik
+rules:
+  - apiGroups: [""]
+    resources: ["services", "endpoints", "secrets", "configmaps", "nodes", "namespaces", "pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses", "ingressclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["update"]
+  - apiGroups: ["traefik.io"]
+    resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps", "middlewares",
+                "middlewaretcps", "tlsoptions", "tlsstores", "traefikservices",
+                "serverstransports", "serverstransporttcps"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: traefik
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: traefik
+subjects:
+  - kind: ServiceAccount
+    name: traefik
+    namespace: traefik

modules/k3s/traefik/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  type: LoadBalancer
+  selector:
+    app: traefik
+  ports:
+    - name: web
+      port: 80
+      targetPort: 80
+    - name: websecure
+      port: 443
+      targetPort: 443

rebuild.sh

@@ -1 +1 @@
-sudo nixos-rebuild switch --flake ./#nixos-vm2
+sudo nixos-rebuild switch --flake ./#qemu-vm